6.5

CVE-2019-5108

Exploit
An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to send IAPP location updates for stations before the required authentication process has completed. This could lead to different denial-of-service scenarios, either by causing CAM table attacks, or by leading to traffic flapping if faking already existing clients in other nearby APs of the same wireless infrastructure. An attacker can forge Authentication and Association Request packets to trigger this vulnerability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version < 5.3
Debian ≫ Debian Linux Version 8.0
Debian ≫ Debian Linux Version 9.0
Canonical ≫ Ubuntu Linux Version 14.04 SwEdition esm
Canonical ≫ Ubuntu Linux Version 16.04 SwEdition esm
Canonical ≫ Ubuntu Linux Version 18.04 SwEdition lts
Netapp ≫ Active Iq Unified Manager Version - SwPlatform vmware_vsphere
Netapp ≫ Cloud Backup Version -
Netapp ≫ E-series Santricity Os Controller Version >= 11.0.0 <= 11.70.1
Netapp ≫ Hci Management Node Version -
Netapp ≫ Solidfire Version -
Netapp ≫ A700s Firmware Version -
   Netapp ≫ A700s Version -
Netapp ≫ H610s Firmware Version -
   Netapp ≫ H610s Version -
Netapp ≫ 8300 Firmware Version -
   Netapp ≫ 8300 Version -
Netapp ≫ 8700 Firmware Version -
   Netapp ≫ 8700 Version -
Netapp ≫ A400 Firmware Version -
   Netapp ≫ A400 Version -
Oracle ≫ Sd-wan Edge Version 8.2
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 10.11% 0.95
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NIST 3.3 6.5 2.9
AV:A/AC:L/Au:N/C:N/I:N/A:P
Cisco Talos 7.4 2.8 4
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

CWE-440 Expected Behavior Violation

A feature, API, or function does not perform according to its specification.

https://www.oracle.com/security-alerts/cpuApr2021.html
Patch
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html
Third Party Advisory
Mailing List
https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html
Third Party Advisory
Mailing List
https://usn.ubuntu.com/4287-1/
Third Party Advisory
https://usn.ubuntu.com/4287-2/
Third Party Advisory
https://usn.ubuntu.com/4286-1/
Third Party Advisory
https://usn.ubuntu.com/4286-2/
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/06/msg00012.html
Third Party Advisory
Mailing List
https://www.debian.org/security/2020/dsa-4698
Third Party Advisory
https://usn.ubuntu.com/4285-1/
Third Party Advisory
http://packetstormsecurity.com/files/156455/Kernel-Live-Patch-Security-Notice-LSN-0063-1.html
Third Party Advisory
VDB Entry
https://security.netapp.com/advisory/ntap-20200204-0002/
Third Party Advisory
https://git.kernel.org/linus/3e493173b7841259a08c5c8e5cbe90adb349da7e
Patch
Vendor Advisory
Mailing List
https://talosintelligence.com/vulnerability_reports/TALOS-2019-0900
Third Party Advisory
Exploit